API: Phoenix railing proxy, API key auth for /api/v1/*, schema export, docs, migrations, tests

- Phoenix API Railing: proxy to PHOENIX_RAILING_URL, tenant me routes
- Tenant-auth: X-API-Key support for /api/v1/* (api_keys table)
- Migration 026: api_keys table; 025 sovereign stack marketplace
- GET /graphql/schema, GET /graphql-playground, api/docs OpenAPI
- Integration tests: phoenix-railing.test.ts
- docs/api/API_VERSIONING: /api/v1/ railing alignment
- docs/phoenix/PORTAL_RAILING_WIRING

Made-with: Cursor

api/docs/openapi-graphql.yaml

@@ -0,0 +1,51 @@
+# Minimal OpenAPI 3 description for Phoenix API GraphQL endpoint.
+# Full schema: GET /graphql/schema (SDL). Interactive: /graphql-playground
+openapi: 3.0.3
+info:
+  title: Phoenix API — GraphQL
+  description: Sankofa Phoenix API GraphQL endpoint. Auth via JWT (Bearer) or X-API-Key for /api/v1/*.
+  version: 1.0.0
+servers:
+  - url: http://localhost:4000
+    description: Default
+paths:
+  /graphql:
+    post:
+      summary: GraphQL query or mutation
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [query]
+              properties:
+                query: { type: string }
+                operationName: { type: string }
+                variables: { type: object }
+      responses:
+        '200':
+          description: GraphQL response (data or errors)
+        '401':
+          description: Unauthorized (optional; many operations allow unauthenticated)
+  /graphql/schema:
+    get:
+      summary: GraphQL schema (SDL)
+      responses:
+        '200':
+          description: Schema as text/plain
+  /graphql-playground:
+    get:
+      summary: GraphQL docs and Sandbox link
+      responses:
+        '200':
+          description: HTML with endpoint and schema links
+components:
+  securitySchemes:
+    BearerAuth:
+      type: http
+      scheme: bearer
+    ApiKeyAuth:
+      type: apiKey
+      in: header
+      name: X-API-Key